CVE-2021-32053 Uncontrolled Resource Consumption in JPA Server in HAPI FHIR
Attackers can cause denial of service in HAPI FHIR JPA Server by triggering resource-intensive history requests that force full index scans.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-32053?
CVE-2021-32053 is a medium-severity denial of service vulnerability in n/a, published on 10 May 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
JPA Server in HAPI FHIR before 5.4.0 allows a user to deny service (e.g., disable access to the database after the attack stops) via history requests. This occurs because of a SELECT COUNT statement that requires a full index scan, with an accompanying large amount of server resources if there are many simultaneous history requests.
Weakness: CWE-400
Which versions are affected by CVE-2021-32053?
2 open source packages ship an affected version, including ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base Maven | All versions | 5.4.0 |
ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base Maven | All versions | 5.4.0 |
Products include Fhir Hapi Fhir.
How do I fix CVE-2021-32053?
Upgrade ca.uhn.hapi.fhir:hapi-fhir-jpaserver-base to 5.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-32053 being exploited?
There is no known exploitation of CVE-2021-32053 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-67f6-c8mx-4q2m.